confgraph 0.3.8__tar.gz → 0.3.9__tar.gz

{confgraph-0.3.8 → confgraph-0.3.9}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: confgraph
-Version: 0.3.8
+Version: 0.3.9
 Summary: Local-first network config dependency mapper — parse, visualize, and lint vendor configs
 Project-URL: Homepage, https://github.com/verigraphs/confgraph
 Project-URL: Repository, https://github.com/verigraphs/confgraph
@@ -131,6 +131,19 @@ See [`docs/CLI_USAGE.md`](docs/CLI_USAGE.md) for all commands, options, and exam
 
 Contributions welcome — new parsers, bug fixes, additional protocol coverage. See [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) to get started.
 
+### Running the tests
+
+```bash
+uv run --extra dev pytest
+```
+
+**The `--extra dev` is not optional.** `pytest` is an optional dependency (see
+`[project.optional-dependencies]`), so a bare `uv run pytest` falls back to
+whatever `pytest` is on your `PATH` — which runs the suite against a different
+environment and fails well over a thousand tests for reasons that have nothing
+to do with your change. There is no error message saying so; it just looks like
+you broke everything.
+
 ## License
 
 Apache 2.0

{confgraph-0.3.8 → confgraph-0.3.9}/README.md

@@ -101,6 +101,19 @@ See [`docs/CLI_USAGE.md`](docs/CLI_USAGE.md) for all commands, options, and exam
 
 Contributions welcome — new parsers, bug fixes, additional protocol coverage. See [`docs/ARCHITECTURE.md`](docs/ARCHITECTURE.md) to get started.
 
+### Running the tests
+
+```bash
+uv run --extra dev pytest
+```
+
+**The `--extra dev` is not optional.** `pytest` is an optional dependency (see
+`[project.optional-dependencies]`), so a bare `uv run pytest` falls back to
+whatever `pytest` is on your `PATH` — which runs the suite against a different
+environment and fails well over a thousand tests for reasons that have nothing
+to do with your change. There is no error message saying so; it just looks like
+you broke everything.
+
 ## License
 
 Apache 2.0

{confgraph-0.3.8 → confgraph-0.3.9}/confgraph/models/topology.py

@@ -28,13 +28,24 @@ class PhysicalLink:
       "cdp"             — from CDP neighbor data
       "lldp"            — from LLDP neighbor data
       "mac-arp"         — validated via MAC-ARP correlation (supplementary only)
+      "upload"          — supplied by the operator (an export from their source
+                          of truth / NMS / IPAM, or a topology file)
+      "synth"           — INFERRED, not observed: synthesized from two devices
+                          having interfaces on a shared L3 subnet
+
+    The "synth" value is load-bearing rather than merely informative, so a
+    producer must label an inferred link honestly.  Consumers distinguish
+    supplied cabling from inference on this field alone — the simulator's
+    link-vs-config consistency checks deliberately say nothing about a "synth"
+    link, because a warning citing one would be the engine disputing its own
+    inference rather than disclosing an input it cannot trust.
     """
 
     device_a: str
     port_a: str           # canonical long-form logical interface on device_a
     device_b: str
     port_b: str           # canonical long-form logical interface on device_b
-    source: str           # "cdp" | "lldp" | "mac-arp"
+    source: str           # "cdp" | "lldp" | "mac-arp" | "upload" | "synth"
     member_count: int = 1
 
 

{confgraph-0.3.8 → confgraph-0.3.9}/confgraph/parsers/__init__.py

@@ -145,7 +145,68 @@ from confgraph.parsers.panos_parser import PANOSParser
 # this module's header is per-commit and not optional for a qualifying
 # change, and deciding otherwise would mean re-deriving "was the predecessor
 # released?" at every review.
-PARSER_BEHAVIOR_VERSION: int = 13
+# 14 (CCR-0217): the JunOS brace branch of ``unsupported_lines`` is fail-closed
+# on the parse OUTCOME — a document routed to the brace tokenizer that yields
+# an EMPTY canonical tree while carrying at least one non-blank
+# comment-stripped line discloses those lines as UnrecognizedBlocks instead of
+# returning silence. The hole was the document with no JunOS idiom in it at all
+# (Cisco ``no`` commands, an IOS ``interface`` block): zero set-family lines
+# routes it brace-ward, every statement is discarded at EOF for want of a ``;``
+# or ``{``, and the result read "no recognized configuration change" for text
+# that plainly requested one — the last silent arm of CCR-0210's fail-closed
+# story, modulo the CCR-0236 mixed-document residual. Observable parse output
+# moves for every such document, with NO ParsedConfig JSON-schema change — the
+# sharp case this constant exists for. Comment-only and whitespace-only
+# documents carry no content and stay silent; ``inactive:``-only documents
+# parse non-empty and keep their existing tag disclosure.
+# 15 (CCR-0214): JunOS ``delete`` / ``deactivate`` statements on MODELLED
+# paths compile to native change ops instead of being disclosed. JunOS emitted
+# no deletion artifact of any kind before this — no tombstones (the grammar is
+# Cisco syntax throughout) and no ops — so a withdrawal, the most outage-prone
+# change class on the OS, could only ever be reported as content the engine
+# could not read. The modelled set is one declarative table
+# (``parsers/junos_deletions.py``): a BGP neighbour, a whole BGP group, a
+# static route, an interface unit. Every path outside it stays on the CCR-0210
+# disclosure channel, so nothing became silent and nothing is half-applied;
+# ``deactivate`` compiles to the same op as ``delete`` because an inactive
+# subtree makes no contribution to the running configuration, which is the
+# only configuration the model holds. Observable parse output moves for any
+# JunOS document carrying one of those statements —
+# ``native_change_ops`` gains entries and ``unrecognized_blocks`` loses the
+# matching lines — with NO ParsedConfig JSON-schema change. No BASELINE moves:
+# a saved configuration states no deletion verb (the brace idiom has none),
+# and the ``inactive:`` statement tag is untouched and still disclosed.
+# 16 (CCR-0214, validation round 1 finding R1): a JunOS removal that the SAME
+# document later re-states no longer compiles — it falls back to the CCR-0210
+# disclosure channel. JunOS applies candidate statements in order, so
+# ``delete protocols bgp group RR`` followed by ``set protocols bgp group RR …``
+# rebuilds the group rather than removing it, and the same idiom moves a static
+# route to a new next-hop. Those are the two commonest JunOS rewrite idioms, and
+# compiling the deletion alone reported a confident teardown of something the
+# device would still have — measured in validation as a CRITICAL full-teardown
+# verdict on a group rebuild. The guard is order-aware (``set`` strictly AFTER
+# the deletion line, at an equal or deeper path): the reverse order really is a
+# removal on a device, so it still compiles. Observable parse output moves for
+# any JunOS document mixing a removal with a later restatement of the same
+# path — ``native_change_ops`` loses that op and ``unrecognized_blocks`` gains
+# the line back — with NO ParsedConfig JSON-schema change, and no baseline
+# motion (a saved configuration states no deletion verb).
+# 17 (CCR-0239 + CCR-0240, bump landed late — caught at the v0.3.9 release
+# audit, 2026-11-06): both landings changed parse output without moving this
+# constant, so PBV-16 parse-cache blobs minted before them could be served as
+# hits carrying the pre-fix models. CCR-0239: NX-OS named OSPF instance tags
+# (``ip router ospf CORE area …``) enroll their interfaces — previously the
+# named-instance spelling bound nothing, so those interfaces were
+# OSPF-invisible. CCR-0240: IOS-XR OSPF passive resolves at all four scopes
+# (process default, area, interface ``passive enable`` AND ``passive
+# disable``) — previously the process-scope default was hardwired False and
+# ``passive disable`` was not in the vocabulary, so suppressed interfaces
+# formed phantom adjacencies while exempted uplinks read as suppressed.
+# Observable parse output moves for any NX-OS config using named instance
+# tags and any IOS-XR config using process/area-scope passive — BASELINES
+# included (both spellings exist in saved configurations). No ParsedConfig
+# JSON-schema change.
+PARSER_BEHAVIOR_VERSION: int = 17
 
 __all__ = [
     "BaseParser",

{confgraph-0.3.8 → confgraph-0.3.9}/confgraph/parsers/iosxr_parser.py

@@ -78,6 +78,26 @@ _AF_HEADER_RE = re.compile(r"^\s*address-family\s+\S+")
 _AF_SPLICE_RE = re.compile(r"^\s*address-family\s+ipv4\s+unicast\b")
 
 
+# CCR-0240. The ONE spelling of the IOS-XR OSPF `passive` line, shared by the
+# scope reader (_read_iosxr_passive) and the `area > interface` body vocabulary
+# table (_OSPF_AREA_IFACE_PATTERNS) so the two cannot drift into disagreeing
+# about which lines count.
+#
+# `disable` is a FIRST-CLASS VALUE, not the absence of `enable`: its whole job is
+# to override a passive inherited from an enclosing scope, which is how an XR
+# estate hardened with a process-wide `passive enable` exempts its uplinks.  A
+# model that encoded `disable` as absence could not express that exemption.
+#
+# The optional keyword is deliberate tolerance.  Cisco's command reference marks
+# both `disable` and `enable` "(Optional)" and its own example TYPES a bare
+# `passive`, while the running-config emits the keyword
+# (syntax-corpus/iosxr/ospf.yaml -> `passive`, status doc-only: `passive disable`
+# is witnessed in a device transcript, the literal `passive enable` is not).  A
+# bare `passive` means passive ON, matching the typed form's documented meaning.
+_IOSXR_PASSIVE_PATTERN = r"^\s+passive(?:\s+(?P<val>enable|disable))?\s*$"
+_IOSXR_PASSIVE_RE = re.compile(_IOSXR_PASSIVE_PATTERN)
+
+
 class _AFTransparentBlock:
     """A read-through view of an IOS-XR block that reads *through* its
     ``address-family ipv4 unicast`` sub-block — and only that one.
@@ -785,6 +805,41 @@ class IOSXRParser(IOSParser):
     # OSPF — interfaces nested under area blocks
     # -----------------------------------------------------------------------
 
+    @staticmethod
+    def _read_iosxr_passive(obj) -> bool | None:
+        """Scope-local OSPF ``passive`` as a TRI-STATE (CCR-0240).
+
+        ``True`` = this scope says passive, ``False`` = this scope says
+        explicitly NOT passive (``passive disable``), ``None`` = this scope said
+        nothing, so the question belongs to the enclosing scope.
+
+        The tri-state is the whole mechanism.  IOS-XR makes ``passive``
+        inheritable at four scopes — router (process), VRF, area and interface —
+        and the vendor states the chain outright: *"If this command is not
+        specified in interface configuration mode, then the interface adopts the
+        passive parameter specified by the area.  If this command is not
+        specified in area configuration mode, then the interface adopts the
+        passive parameter specified for the process.  If this command is not
+        specified at any level, then the passive parameter is disabled"*
+        (ASR9000 routing command reference, "passive (OSPF)"; Command Modes:
+        Interface / Area / Router / VRF).  A two-valued read cannot tell "not
+        specified here" from "specified off", and collapsing the two is exactly
+        the bug: the exempted uplink becomes indistinguishable from a
+        suppressed one.
+
+        Direct children only.  ``obj.children`` rather than
+        ``find_child_objects`` because an ``area N`` block's descendants include
+        its ``interface X`` sub-blocks, whose ``passive`` belongs to the
+        interface and must not be read as the area's.  Last line wins, which is
+        what a device does with a repeated statement.
+        """
+        state: bool | None = None
+        for child in obj.children:
+            m = _IOSXR_PASSIVE_RE.match(child.text)
+            if m:
+                state = m.group("val") != "disable"
+        return state
+
     def parse_ospf(self) -> list[OSPFConfig]:
         """Parse OSPF configurations for IOS-XR.
 
@@ -828,13 +883,27 @@ class IOSXRParser(IOSParser):
                 if v:
                     auto_cost_ref_bw = int(v)
 
-            # Passive interface default (IOS-XR: per-interface "passive enable")
-            passive_interface_default = False
-            passive_interfaces: list[str] = []
-            non_passive_interfaces: list[str] = []
+            # Passive, at PROCESS scope (CCR-0240). `passive enable` / `passive
+            # disable` as a direct child of `router ospf N` is the default every
+            # area and interface inherits; it used to be hardwired False, so the
+            # standard XR hardening idiom ("suppress everywhere, re-enable per
+            # uplink") read as nothing suppressed anywhere.
+            #
+            # `passive_interface_default` carries the PROCESS-scope answer only —
+            # a tri-state None means nothing was specified at this level, which
+            # the vendor defines as not passive.  Area- and interface-scope
+            # overrides are resolved per interface into the two lists below, so
+            # the engine's resolver gets the right answer under either branch of
+            # `passive_interface_default`.
+            process_passive = self._read_iosxr_passive(ospf_obj)
+            passive_interface_default = process_passive is True
 
             # Parse areas — IOS-XR has "area N" stanzas with nested interfaces
-            areas, passive_interfaces = self._parse_ospf_areas_iosxr(ospf_obj, process_id)
+            areas, passive_interfaces, non_passive_interfaces = (
+                self._parse_ospf_areas_iosxr(
+                    ospf_obj, process_id, passive_default=process_passive
+                )
+            )
 
             # Redistribution
             redistribute = self._parse_ospf_redistribute_iosxr(ospf_obj)
@@ -1008,7 +1077,27 @@ class IOSXRParser(IOSParser):
             except ValueError:
                 pass
 
-        areas, passive_interfaces = self._parse_ospf_areas_iosxr(vrf_obj, process_id)
+        # CCR-0240. `passive` is legal in VRF configuration mode as well as
+        # router/area/interface mode, and a VRF sub-block sits INSIDE the process
+        # block — so the inherited default here is the VRF's own setting if it has
+        # one, else the enclosing `router ospf N`'s.  Threading the process scope
+        # through is not optional: without it a process-wide `passive enable`
+        # would apply to the global instance's interfaces and silently vanish for
+        # the VRF's, which is the same defect in a second place.
+        parent = getattr(vrf_obj, "parent", None)
+        process_passive = (
+            self._read_iosxr_passive(parent)
+            if parent is not None and parent is not vrf_obj
+            else None
+        )
+        vrf_passive = self._read_iosxr_passive(vrf_obj)
+        passive_default = vrf_passive if vrf_passive is not None else process_passive
+
+        areas, passive_interfaces, non_passive_interfaces = (
+            self._parse_ospf_areas_iosxr(
+                vrf_obj, process_id, passive_default=passive_default
+            )
+        )
         redistribute = self._parse_ospf_redistribute_iosxr(vrf_obj)
 
         return OSPFConfig(
@@ -1020,20 +1109,36 @@ class IOSXRParser(IOSParser):
             vrf=vrf_name,
             router_id=router_id,
             areas=areas,
+            passive_interface_default=passive_default is True,
             passive_interfaces=passive_interfaces,
+            non_passive_interfaces=non_passive_interfaces,
             redistribute=redistribute,
         )
 
     def _parse_ospf_areas_iosxr(
-        self, ospf_obj, process_id: int | str | None = None
-    ) -> tuple[list[OSPFArea], list[str]]:
+        self,
+        ospf_obj,
+        process_id: int | str | None = None,
+        *,
+        passive_default: bool | None = None,
+    ) -> tuple[list[OSPFArea], list[str], list[str]]:
         """Parse OSPF areas with nested interface blocks (IOS-XR style).
 
-        Returns a tuple of (areas, passive_interfaces).
+        ``passive_default`` is the ``passive`` state inherited from the enclosing
+        scope as a tri-state (``None`` = nothing specified above), already
+        resolved by the caller down the process → VRF chain.
+
+        Returns a tuple of (areas, passive_interfaces, non_passive_interfaces).
+        Both lists are populated from the RESOLVED per-interface state, so the
+        engine's resolver is correct under either branch of
+        ``passive_interface_default`` — it asks ``name not in
+        non_passive_interfaces`` when the default is passive and ``name in
+        passive_interfaces`` when it is not (CCR-0240).
         """
         areas: list[OSPFArea] = []
         area_dict: dict[str, dict] = {}
         passive_interfaces: list[str] = []
+        non_passive_interfaces: list[str] = []
 
         area_children = ospf_obj.find_child_objects(r"^\s+area\s+(\S+)")
         for area_child in area_children:
@@ -1136,6 +1241,12 @@ class IOSXRParser(IOSParser):
                     except ValueError:
                         pass
 
+            # Passive, at AREA scope (CCR-0240) — overrides the process/VRF
+            # default for this area's interfaces, and is itself overridden by an
+            # interface-scope statement.
+            area_passive = self._read_iosxr_passive(area_child)
+            area_default = area_passive if area_passive is not None else passive_default
+
             # Interfaces nested under area
             for intf_child in area_child.find_child_objects(r"^\s+interface\s+(\S+)"):
                 intf_name = self._extract_match(intf_child.text, r"^\s+interface\s+(\S+)")
@@ -1143,24 +1254,39 @@ class IOSXRParser(IOSParser):
                     continue
                 if intf_name not in area_dict[area_id]["interfaces"]:
                     area_dict[area_id]["interfaces"].append(intf_name)
-                # IOS-XR marks passive with "passive enable" inside the interface block
-                if intf_child.find_child_objects(r"^\s+passive\s+enable"):
+
+                # Resolve the inheritance chain: interface ?? area ?? VRF ??
+                # process.  `passive disable` here is the uplink exemption and
+                # resolves to an explicit False, which is a different fact from
+                # "nobody said" (None) — the first lands in
+                # non_passive_interfaces so the engine can un-gate the uplink
+                # against a passive default, the second lands in neither list
+                # because no scope made a claim.
+                intf_passive = self._read_iosxr_passive(intf_child)
+                resolved = intf_passive if intf_passive is not None else area_default
+                if resolved is True:
                     if intf_name not in passive_interfaces:
                         passive_interfaces.append(intf_name)
+                elif resolved is False:
+                    if intf_name not in non_passive_interfaces:
+                        non_passive_interfaces.append(intf_name)
+
                 area_dict[area_id]["interface_settings"][intf_name] = (
                     self._parse_ospf_area_interface(
-                        intf_child, intf_name, area_id, process_id
+                        intf_child, intf_name, area_id, process_id,
+                        passive=resolved,
                     )
                 )
 
         for area_data in area_dict.values():
             areas.append(OSPFArea(**area_data))
 
-        return areas, passive_interfaces
+        return areas, passive_interfaces, non_passive_interfaces
 
     # IOS-XR OSPF `area > interface` body → OSPFInterfaceConfig field. One row per
-    # setting; the regex's `val` group is the value, or the row is a bare flag
-    # (no group) whose presence means True.
+    # setting; the regex's `val` group is the value — cast by _OSPF_INT_FIELDS or
+    # read as an enable/disable keyword by _OSPF_ENABLE_DISABLE_FIELDS — or the row
+    # is a bare flag (no group) whose presence means True.
     #
     # This is the extraction half of CCR-0038 Theme 2. The ATTRIBUTION half — the
     # part that used to be missing entirely on IOS-XR, and duplicated per-OS on
@@ -1177,10 +1303,12 @@ class IOSXRParser(IOSParser):
         ("authentication", r"^\s+authentication\s+(?P<val>message-digest|null)\s*$"),
         ("bfd_interval",   r"^\s+bfd\s+minimum-interval\s+(?P<val>\d+)\s*$"),
         ("bfd_multiplier", r"^\s+bfd\s+multiplier\s+(?P<val>\d+)\s*$"),
+        # `<setting> enable | disable` — the keyword IS the value, so `disable`
+        # is parsed as False rather than dropped on the floor (CCR-0240).
+        ("passive",        _IOSXR_PASSIVE_PATTERN),
         # Bare flags — presence is the value.
         ("bfd",            r"^\s+bfd\s+fast-detect\s*$"),
         ("mtu_ignore",     r"^\s+mtu-ignore\s+enable\s*$"),
-        ("passive",        r"^\s+passive\s+enable\s*$"),
     )
 
     _OSPF_INT_FIELDS = frozenset({
@@ -1188,9 +1316,18 @@ class IOSXRParser(IOSParser):
         "bfd_interval", "bfd_multiplier",
     })
 
+    # Rows whose `val` group is an IOS-XR `enable`/`disable` keyword rather than a
+    # scalar: `enable` (or the keyword's absence, which is legal when typed) means
+    # True and `disable` means False.  A sibling of _OSPF_INT_FIELDS, so the
+    # (N+1)th enable/disable-valued setting is one row in the table plus one entry
+    # here — not a branch in the loop.  [[CCR-0240]]
+    _OSPF_ENABLE_DISABLE_FIELDS = frozenset({"passive"})
+
     def _parse_ospf_area_interface(
         self, intf_child, intf_name: str, area_id: str,
         process_id: int | str | None = None,
+        *,
+        passive: bool | None = None,
     ) -> OSPFInterfaceConfig:
         """One ``area N > interface NAME`` block → OSPFInterfaceConfig.
 
@@ -1202,6 +1339,15 @@ class IOSXRParser(IOSParser):
         settings = OSPFInterfaceConfig(
             name=intf_name, area_id=area_id, process_id=process_id
         )
+        # CCR-0240: `passive` is seeded with the RESOLVED state the caller worked
+        # out down the process → VRF → area → interface chain, before the body is
+        # read.  An interface-scope `passive` line then overwrites it with the
+        # same answer (the caller derived `passive` from that very line), so the
+        # seed is what makes an INHERITED passive visible on an interface whose
+        # own block is silent — the model field is a plain bool and has no way to
+        # say "ask my area".
+        if passive is not None:
+            settings.passive = passive
         for child in intf_child.children:
             text = child.text
             for field, pattern in self._OSPF_AREA_IFACE_PATTERNS:
@@ -1210,7 +1356,13 @@ class IOSXRParser(IOSParser):
                     continue
                 if "val" in m.groupdict():
                     raw = m.group("val")
-                    value: object = int(raw) if field in self._OSPF_INT_FIELDS else raw
+                    if field in self._OSPF_ENABLE_DISABLE_FIELDS:
+                        # `enable`, or the keyword omitted entirely, means True.
+                        value: object = raw != "disable"
+                    elif field in self._OSPF_INT_FIELDS:
+                        value = int(raw)
+                    else:
+                        value = raw
                 else:
                     value = True  # bare flag
                 setattr(settings, field, value)